media: video/hdmi: handle short reads of hdmi info frame.

[ Upstream commit 4a92fc6e55da5b87cecb572275deaff6ac9dd27e ]

Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all
the size checking done later in hdmi_infoframe_unpack().  A better
value is the amount of data read into buffer.

Fixes: 480b8b3e42c3 ("video/hdmi: Pass buffer size to infoframe unpack functions")
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c
index 41f4e749a859c3a753a8d12bf44377b23039045d..2217004264e4bcc6290df022aa84427c31aa63ac 100644 (file)
--- a/drivers/media/i2c/adv7511-v4l2.c
+++ b/drivers/media/i2c/adv7511-v4l2.c
@@ -544,7 +544,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_
        buffer[3] = 0;
        buffer[3] = hdmi_infoframe_checksum(buffer, len + 4);
 
-       if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
+       if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) {
                v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
                return;
        }

diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
index 122e1fdccd96263b9f5819b91add0002b94371c7..d688ffff7a07456ac9f22b6a63ceb5210bb43413 100644 (file)
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -2484,7 +2484,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index,
                buffer[i + 3] = infoframe_read(sd,
                                       adv76xx_cri[index].payload_addr + i);
 
-       if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) {
+       if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) {
                v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__,
                         adv76xx_cri[index].desc);
                return -ENOENT;

diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index 7f8acbdf0db4afe0df9c27782d0e1a8e5e374b2c..8ab4c63839b4954d199ffa6906bea7a4324420db 100644 (file)
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -2593,7 +2593,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7842_cfg_read_
        for (i = 0; i < len; i++)
                buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i);
 
-       if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) {
+       if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) {
                v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc);
                return;
        }